Pinned Repositories
ArtifactParsers
A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts
awesome-executable-packing
A curated list of awesome resources related to executable packing
awesome-incident-response
A curated list of tools for incident response
Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
detection-rules
donut
Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
EVTX-ETW-Resources
Event Tracing For Windows (ETW) Resources
forensictools
Collection of forensic tools
InsightEngineering
Hardcore Debugging
JonMon
theArchitect0x12's Repositories
theArchitect0x12/ArtifactParsers
A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts
theArchitect0x12/awesome-executable-packing
A curated list of awesome resources related to executable packing
theArchitect0x12/awesome-incident-response
A curated list of tools for incident response
theArchitect0x12/Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
theArchitect0x12/detection-rules
theArchitect0x12/donut
Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
theArchitect0x12/EVTX-ETW-Resources
Event Tracing For Windows (ETW) Resources
theArchitect0x12/forensictools
Collection of forensic tools
theArchitect0x12/InsightEngineering
Hardcore Debugging
theArchitect0x12/JonMon
theArchitect0x12/LinuxForensics
Everything related to Linux Forensics
theArchitect0x12/MDE-DFIR-Resources
A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.
theArchitect0x12/Microsoft-Analyzer-Suite
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
theArchitect0x12/OffensiveRust
Rust Weaponization for Red Team Engagements.
theArchitect0x12/protections-artifacts
Elastic Security detection content for Endpoint
theArchitect0x12/Supernova
Real fucking shellcode encryptor & obfuscator tool
theArchitect0x12/Windows-driver-samples
This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.
theArchitect0x12/windows-drivers-rs
Platform that enables Windows driver development in Rust. Developed by Surface.
theArchitect0x12/windows-syscalls
Windows System Call Tables (NT/2000/XP/2003/Vista/2008/7/2012/8/10)
theArchitect0x12/wiskess_rust
WISKESS automates the Windows evidence processing for Incident Response investigations. Rust version.
theArchitect0x12/XProtect-Malware-Families
Mapping XProtect's obfuscated malware family names to common industry names.